CVE-2025-5767

CVE-2025-5767 : Crowdfunding for WooCommerce (WordPress) is affected by a stored XSS via the width parameter in versions up to 3.1.14. Exploitation requires authenticated access at Contributor level or higher, enabling an attacker to inject scripts that execute when a user visits the injected pag...

CVE-2025-5767 Crowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5767 Crowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6726 Block Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update

The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classicgalleryslideroptions function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with...

CVE-2025-6726 Block Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update

The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classicgalleryslideroptions function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with...

CVE-2025-5754

CVE-2025-5754 affects the WordPress plugin Useful Tab Block – Responsive & AMP-Compatible . The vulnerability is a Stored Cross-Site Scripting (XSS) via the className parameter caused by insufficient input sanitization and output escaping. It requires authentication at Contributor level or higher...

CVE-2025-6813

The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the autologin function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gai...

CVE-2025-7648

The Ruven Themes: Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ruvenbutton' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-6781

The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to upda...

CVE-2025-5816

The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.0 via the getorderdetail due to missing validation on a user controlled key. This makes it possible for...

CVE-2025-6053

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-6781

CVE-2025-6781 affects the Copymatic – AI Content Writer & Generator WordPress plugin (versions ≤ 2.1). The issue is a Cross-Site Request Forgery on the copymatic-menu page, allowing unauthenticated attackers to update the copymatic_apikey option if a site administrator is tricked into performing ...

CVE-2025-6053 Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-7431

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2025-29998 · WordPress · Listly: Listicles For Wordpress

Name of the Vulnerable Software and Affected Versions: Listly: Listicles For WordPress plugin versions prior to 2.8 Description: The Listly: Listicles For WordPress plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check within the Init function...

PT-2025-29991 · WordPress · Forminator Forms

Name of the Vulnerable Software and Affected Versions: Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions prior to 1.45.1 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is susceptible to...

PT-2025-29995 · WordPress · The Useful Tab Block – Responsive & Amp-Compatible

Name of the Vulnerable Software and Affected Versions: The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress versions prior to 1.3.3 Description: The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is susceptible to Stored Cross-Site Scripting through the...

WordPress plugin Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Malcure...

PT-2025-30000 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions through 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection via the id parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow...

PT-2025-30001 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions up to and including 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection due to a missing capability check on the b1 run query API endpoint. This allows authenticated attackers...